The Anti-virus Times

Wednesday, October 26, 2016

If you've ever seen the results of comparative anti-virus software tests, you’ve probably noticed that the number of objects scanned can vary greatly depending on the product being tested. And sometimes these figures are significantly higher than the number of files in a scanned collection. The reason for this is rather prosaic.

An anti-virus is also a universal decompressor that allows any object to be split into parts, even a corrupted object that can’t be processed by any archive extraction utility.

Here are just two paragraphs of anti-virus requirements from a tender document:

And far more formats exist than that!

But even ordinary anti-virus scanning can present surprises with regards to the number of objects scanned. Take, for example, a zero-size file:

Let's have the anti-virus scan it.

What’s this? A miracle? Why have two objects been scanned? Was the counter bumped up? Actually, everything is on the level: an anti-virus scans files (and folders) according to parameters that are invisible to ordinary users.

Remember the fictional character Mary Poppins who had a magical handbag in which she could store all sorts of items, no matter what shape or size? Neither the size nor the weight of her handbag ever changed. Files and directories in the NTFS file system used in Windows are just like that “magical handbag”.

Everyone knows that a file has attributes—read and write permissions.

But, in addition to these attributes, you can assign others for a file (and a folder)—and they won’t be visible to users who use traditional file managers.

For example, in a zero-size file, you can write another file.

Take an eicar test virus (for example, at http://www.eicar.org/85-0-Download.html). This "program" (EICAR-European Institute for Computer Anti-Virus Research) has been specially designed to let users see how an anti-virus will report a detected virus, without subjecting their computers to any danger.

But don’t forget to disable your anti-virus protection before you download this test file; otherwise, you will see something like this:

Go to a command line, and copy the downloaded fake anti-virus into any file.

Open a file manager, and make sure that the file size has not changed:

After this, scan this file:

So that's how you can hide some important objects from a user's attention.